[BHaType]

Originally Posted by larrybrains I have a player that consistently gets a lot of "is suspected in using invalid user commands" over multiple dates, but almost always 0 dropped packets. The player in question isn't an exceptionally skilled player by any means and other players do occasionally get the same "invalid user commands" detections, but not nearly as much as this one. I feel like these are false positives, but let me know what you think.[/PHP]

Thanks for report I found an error in plugin. I think those are false positive but who knows try new version.
In new version you can see exact reason why player has been reported and decide if it was false positive or not

Updated

PHP Code:

- Fixed wrong structure offset
- Added more detailed reports 


[larrybrains]

Originally Posted by BHaType Thanks for report I found an error in plugin. I think those are false positive but who knows try new version. In new version you can see exact reason why player has been reported and decide if it was false positive or not Updated PHP Code: - Fixed wrong structure offset - Added more detailed reports

Thanks, will try this out!

[larrybrains]

Originally Posted by BHaType In new version you can see exact reason why player has been reported and decide if it was false positive or not

I have been running the new version for a few days and the same player had some more detections yesterday:

PHP Code:

L 01/31/2024 - 00:05:13: [l4d2_user_commands.smx] Player D*******Y <3<14><STEAM_1:1:4*******3><> is suspected in using invalid user commands (reason: Tickbase out of bounds (min: 129224, tick: 128849, max: 129724), dropped packets 0)
L 01/31/2024 - 00:35:13: [l4d2_user_commands.smx] Player D*******Y <3<11><STEAM_1:1:4*******3><> is suspected in using invalid user commands (reason: Tickbase out of bounds (min: 78134, tick: 76966, max: 78634), dropped packets 0)
L 01/31/2024 - 00:54:23: [l4d2_user_commands.smx] Player D*******Y <3<26><STEAM_1:1:4*******3><> is suspected in using invalid user commands (reason: Tickbase out of bounds (min: 69257, tick: 69186, max: 69757), dropped packets 0) 


What does "Tickbase out of bounds" mean?

[BHaType]

Originally Posted by Spirit_12 You may want to add SMAC as a requirement.

Thanks for report

Originally Posted by larrybrains What does "Tickbase out of bounds" mean?

Every client has it's own tick counter called tickbase.
Tickbase is always kept in sync with server's tick within some 'approximate' range.

Client tickbase can get out sync by next reaons:

1. Server is lagging or has plugins that affects commands execution pipeline
2. Client lost connection to server and then restored connection later
3. Client is cheating

Originally Posted by larrybrains PHP Code: L 01/31/2024 - 00:05:13: [l4d2_user_commands.smx] Player D*******Y <3<14><STEAM_1:1:4*******3><> is suspected in using invalid user commands (reason: Tickbase out of bounds (min: 129224, tick: 128849, max: 129724), dropped packets 0) L 01/31/2024 - 00:35:13: [l4d2_user_commands.smx] Player D*******Y <3<11><STEAM_1:1:4*******3><> is suspected in using invalid user commands (reason: Tickbase out of bounds (min: 78134, tick: 76966, max: 78634), dropped packets 0) L 01/31/2024 - 00:54:23: [l4d2_user_commands.smx] Player D*******Y <3<26><STEAM_1:1:4*******3><> is suspected in using invalid user commands (reason: Tickbase out of bounds (min: 69257, tick: 69186, max: 69757), dropped packets 0)

Let's do simple analyse of every log and calculate tickbase difference to see how far into future or past he got relatively to server's clock.

1. log: 129224 - 128849 = 375
2. log: 78134 - 76966 = 1,168
3. log: 69257 - 69186= 71

Those are insanely big values (even 71 tick gap is big value).
By second log we can see that he got into past by ~39 seconds if your server has default tickrate (tickbase difference * server tickrate).

We can get to conclusions:

• Your server lagged for ~39 seconds but then every player on the server would have been reported.
• The client lost connection to server for ~39 seconds xD
• The client is cheating

if your server didn't lag and the client also didn't lost connection then I can conclude he's cheating.